CVE-2024-7046
Published Mar 20, 2025
CVSS n/a
EPSS n/a
KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-6947 | An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details. |
 Github GHSA |
GHSA-gv26-qw3h-8qvp | Open WebUI Allows Viewing of Admin Details |
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
No reference.
History
Aug 13, 2026 4:30 PM
Title updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Improper Access Control in open-webui/open-webui | |
| Metrics |
ssvc
|
Aug 13, 2026 3:30 PM
Weaknesses updated. Affected versions updated. Affected vendors updated. References updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-862 | |
| CPEs | ||
| Vendors & Products |
Openwebui
Openwebui open Webui |
|
| References |
|
|
| Metrics |
cvssV3_0
|
Aug 13, 2026 3:15 PM
Description updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details. | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
Oct 15, 2025 1:30 PM
Weaknesses updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-475 |
Oct 15, 2025 1:00 PM
Weaknesses updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-862 |
Jul 29, 2025 6:15 PM
First appearance in the feed. Affected versions updated. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openwebui
Openwebui open Webui |
|
| CPEs | cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:* | |
| Vendors & Products |
Openwebui
Openwebui open Webui |
Mar 20, 2025 7:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mar 20, 2025 10:15 AM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details. | |
| Title | Improper Access Control in open-webui/open-webui | |
| Weaknesses | CWE-475 | |
| References |
| |
| Metrics |
cvssV3_0
|
Subscriptions
Weaknesses
No weakness.
